{ "dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": { "cveId": "CVE-2026-98347", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-09-25T10:25:14.343Z", "datePublished": "2026-10-06T08:46:36.136Z", "dateUpdated": "2026-10-19T09:17:58.195Z" }, "containers": { "cna": { "providerMetadata": { "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-10-19T09:17:58.195Z" }, "descriptions": [ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nIB/IPoIB: Avoid restoring OPER_UP after multicast flush\n\nipoib_ib_dev_flush_light() temporarily clears IPOIB_FLAG_OPER_UP to\nprevent multicast joins while ipoib_mcast_dev_flush() is running, and\nrestores the flag afterwards if it was previously set.\n\nThis restore races with ipoib_ib_dev_down(). If the interface is brought\ndown while the flush is in progress, ipoib_ib_dev_down() clears\nIPOIB_FLAG_OPER_UP, but the flush path may set it again after the device\nhas already gone down.\n\nSince commit 894021a75291 (\"IB/ipoib: Make the carrier_on_task race\naware\"), ipoib_mcast_carrier_on_task() relies on IPOIB_FLAG_OPER_UP\nbeing cleared to terminate its rtnl_trylock() retry loop. If the flag is\nleft set after shutdown, the workqueue retries forever, causing teardown\nto deadlock when ipoib_ndo_uninit() waits in destroy_workqueue() while\nholding RTNL.\n\nInstead of overloading IPOIB_FLAG_OPER_UP to block multicast joins\nduring a light flush, introduce a dedicated IPOIB_FLAG_MCAST_FLUSH flag.\nUse it together with IPOIB_FLAG_OPER_UP to determine whether multicast\njoins are allowed, avoiding the race with device shutdown." } ], "affected": [ { "product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "drivers/infiniband/ulp/ipoib/ipoib.h", "drivers/infiniband/ulp/ipoib/ipoib_ib.c", "drivers/infiniband/ulp/ipoib/ipoib_multicast.c" ], "versions": [ { "version": "344bacca8cd811809fc33a249f2738ab757d327f", "lessThan": "f973769fb7cb33ba0d4a64b7dcfee0cabaead938", "status": "affected", "versionType": "git" }, { "version": "344bacca8cd811809fc33a249f2738ab757d327f", "lessThan": "b72f38929f4b5aa83161fd3b22a7327207e51ec5", "status": "affected", "versionType": "git" }, { "version": "344bacca8cd811809fc33a249f2738ab757d327f", "lessThan": "1b11e4b55b41d9e69a8e8d07622614202e2eaca9", "status": "affected", "versionType": "git" }, { "version": "344bacca8cd811809fc33a249f2738ab757d327f", "lessThan": "326f7d34bd7e64de535566b65c0533b640df5a81", "status": "affected", "versionType": "git" }, { "version": "344bacca8cd811809fc33a249f2738ab757d327f", "lessThan": "5ad925d45f28464a5e043c9620880bb6a030da89", "status": "affected", "versionType": "git" }, { "version": "344bacca8cd811809fc33a249f2738ab757d327f", "lessThan": "188b334a6db36a8e0bfaaf59bc4020639a0f3aad", "status": "affected", "versionType": "git" }, { "version": "344bacca8cd811809fc33a249f2738ab757d327f", "lessThan": "1ff3add37c329704ec46181b4ae4f00f9f16ce6f", "status": "affected", "versionType": "git" }, { "version": "344bacca8cd811809fc33a249f2738ab757d327f", "lessThan": "9a141d3dc869d18b2eab35e999f4790a9b84e40f", "status": "affected", "versionType": "git" }, { "version": "a289c65ca49d2680a3d797e633e57a45573d1df2", "status": "affected", "versionType": "git" }, { "version": "b81459c78935e4579a577b2366c5f8878d3c7fee", "status": "affected", "versionType": "git" }, { "version": "8a9d8dc9ce83a90bfbbe69181acc4cf1beff46f5", "status": "affected", "versionType": "git" }, { "version": "dfe809702a11bd7fb91c882fb55620e39ce22109", "status": "affected", "versionType": "git" }, { "version": "87160fb51bc343793cc8f5f031a87f1a35aecb82", "status": "affected", "versionType": "git" }, { "version": "749fd55dd210f9676f0d445a6efaaa3bec65174a", "status": "affected", "versionType": "git" }, { "version": "3.2.84", "lessThan": "3.3", "status": "affected", "versionType": "semver" }, { "version": "3.10.105", "lessThan": "3.11", "status": "affected", "versionType": "semver" }, { "version": "3.12.65", "lessThan": "3.13", "status": "affected", "versionType": "semver" }, { "version": "3.16.39", "lessThan": "3.17", "status": "affected", "versionType": "semver" }, { "version": "4.4.24", "lessThan": "4.5", "status": "affected", "versionType": "semver" }, { "version": "4.7.7", "lessThan": "4.8", "status": "affected", "versionType": "semver" } ] }, { "product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "drivers/infiniband/ulp/ipoib/ipoib.h", "drivers/infiniband/ulp/ipoib/ipoib_ib.c", "drivers/infiniband/ulp/ipoib/ipoib_multicast.c" ], "versions": [ { "version": "4.8", "status": "affected" }, { "version": "0", "lessThan": "4.8", "status": "unaffected", "versionType": "semver" }, { "version": "5.10.271", "lessThanOrEqual": "5.10.*", "status": "unaffected", "versionType": "semver" }, { "version": "5.15.222", "lessThanOrEqual": "5.15.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.1.189", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.6.158", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.12.112", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.18.54", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver" }, { "version": "7.2.8", "lessThanOrEqual": "7.2.*", "status": "unaffected", "versionType": "semver" }, { "version": "7.3", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix" } ] } ], "cpeApplicability": [ { "nodes": [ { "operator": "OR", "negate": false, "cpeMatch": [ { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.8", "versionEndExcluding": "5.10.271" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.8", "versionEndExcluding": "5.15.222" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.8", "versionEndExcluding": "6.1.189" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.8", "versionEndExcluding": "6.6.158" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.8", "versionEndExcluding": "6.12.112" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.8", "versionEndExcluding": "6.18.54" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.8", "versionEndExcluding": "7.2.8" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.8", "versionEndExcluding": "7.3" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.2.84" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.10.105" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.12.65" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.16.39" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.4.24" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.7.7" } ] } ] } ], "references": [ { "url": "https://git.kernel.org/stable/c/f973769fb7cb33ba0d4a64b7dcfee0cabaead938" }, { "url": "https://git.kernel.org/stable/c/b72f38929f4b5aa83161fd3b22a7327207e51ec5" }, { "url": "https://git.kernel.org/stable/c/1b11e4b55b41d9e69a8e8d07622614202e2eaca9" }, { "url": "https://git.kernel.org/stable/c/326f7d34bd7e64de535566b65c0533b640df5a81" }, { "url": "https://git.kernel.org/stable/c/5ad925d45f28464a5e043c9620880bb6a030da89" }, { "url": "https://git.kernel.org/stable/c/188b334a6db36a8e0bfaaf59bc4020639a0f3aad" }, { "url": "https://git.kernel.org/stable/c/1ff3add37c329704ec46181b4ae4f00f9f16ce6f" }, { "url": "https://git.kernel.org/stable/c/9a141d3dc869d18b2eab35e999f4790a9b84e40f" } ], "title": "IB/IPoIB: Avoid restoring OPER_UP after multicast flush", "x_generator": { "engine": "bippy-1.2.0" } } } }